diff --git a/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c b/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c
--- a/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c
+++ b/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c
@@ -385,6 +385,12 @@
 	m_adj(event, sizeof(*ep));
 
 	for (; ep->num_responses > 0; ep->num_responses --) {
+		/* Each Inquiry Result response is 14 bytes.  A malformed event
+		   whose num_responses exceeds the payload would otherwise read
+		   past the mbuf chain. */
+		if (event->m_len < (int)(sizeof(bdaddr) + 3 +
+		    NG_HCI_CLASS_SIZE + sizeof(n->clock_offset)))
+			break;
 		/* Get remote unit address */
 		m_copydata(event, 0, sizeof(bdaddr), &bdaddr);
 		m_adj(event, sizeof(bdaddr));